Monitoring Splunk

how to force splunk to monitor a directory.

sfmandmdev
Path Finder

How do I force splunk to index new files in the directory that is being monitored immediately? sometimes it takes really long for it to detect/index new files. I have just one folder that splunk is monitoring... and it still doesn't pick up my file. I have to bounce the forwarder everytime, to make splunk pick up my new files. Is there a setting somewhere, that i can change, to make splunk monitor my dir more often that is... Or is there a CLI command that I can issue to force splunk to monitor that dir ?

Splunk Indexer: 4.1.4-82143 Splunk Forwarder:4.0.10-77919

Thanks!

Tags (1)

gkanapathy
Splunk Employee
Splunk Employee

I'd recommend that you switch the forwarder over to 4.1.x. There isn't much you can do about the file monitor in 4.0, but it was re-implemented for 4.1 and now offers much better and more responsive performance.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...